Skip to content

Document the tls_automate_names global option - #570

Open
IslamElsayed wants to merge 3 commits into
caddyserver:masterfrom
IslamElsayed:docs-tls-automate-names
Open

IslamElsayed wants to merge 3 commits into
caddyserver:masterfrom
IslamElsayed:docs-tls-automate-names

Conversation

@IslamElsayed

Copy link
Copy Markdown

Documents the tls_automate_names global option added in caddyserver/caddy#8015, as @steadytao asked for on that PR.

The name is the one @francislavoie settled on there, so this should not need renaming — but if it does move, it is this one entry plus the line in the syntax summary.

One thing I could not determine and would like corrected rather than guessed at: I wrote "(Requires Caddy 2.12 or newer.)" on the basis that v2.11.4 is the latest release, so the next minor would be 2.12. If the option lands in a different version, that line is wrong.

I checked both code samples against a build of the caddy PR rather than writing them from memory:

  • the tls_automate_names example adapts to certificates.automate: ["*.example.com"] with a route only for foo.example.com
  • the empty-site-block example does produce the *.example.com route the text warns about

The other claims in the entry — that a name with its own site block keeps that site's settings, that the option accumulates when repeated, and that a Caddyfile of only global options is valid with it set — are each covered by an adapt test in the code PR.

Disclosure: I use AI assistance when working on patches. I wrote and checked this entry myself, and verified every example and claim above against a build.

Added in caddyserver/caddy#8015: names certificates should be managed for
without adding a route for them, replacing the empty-site-block workaround.

@steadytao steadytao left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Otherwise looks alright.

Comment thread src/docs/markdown/caddyfile/options.md Outdated


##### `tls_automate_names`
Manages certificates for the given names without serving them. The names get the same certificate management [Automatic HTTPS](/docs/automatic-https) gives the names in your site blocks, but no route is added, so Caddy does not respond for them.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

State that this is an explicit request and still enables certificate management when auto_https off or disable_certs is configured. The implementation deliberately behaves like force_automate; describing it only as the same management provided by Automatic HTTPS does not make that precedence clear.

Comment thread src/docs/markdown/caddyfile/options.md Outdated

A name that also has its own site block keeps that site's certificate settings. May be repeated; the names accumulate.

(Requires Caddy 2.12 or newer.)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove this version claim until the target release is confirmed.

The version note was a guess from v2.11.4 being the latest release.
@francislavoie and @steadytao settled on 2.11.5 rather than 2.12 on
caddyserver/caddy#8015, since the option is a low-impact addition and not
an API change.
@IslamElsayed

Copy link
Copy Markdown
Author

Updated the version note from "2.12 or newer" to "2.11.5 or newer" in 30a0dc0, following @francislavoie and @steadytao settling on 2.11.5 for this in caddyserver/caddy#8015 — it was the one thing in here I had flagged as a guess rather than a fact.

@steadytao

Copy link
Copy Markdown
Member

Cheers. Just the remaining comments then should be good.

@steadytao's review: describing the option only as the management
Automatic HTTPS provides hid the precedence. Listing a name is an
explicit request, so it is still managed when auto_https is off or
disable_certs, the same way the tls directive's force_automate forces
automation for a site.

Verified by adapting both: `auto_https off` and `auto_https disable_certs`
each leave the name in the automate loader. caddyserver/caddy#8015 pins
the first in tls_automate_names_auto_https_off.caddyfiletest.
@IslamElsayed

Copy link
Copy Markdown
Author

Both addressed — and apologies for the delay on the first one, I missed your inline comments for four days because I was filtering reviews by date and they predated the window I was looking at. Entirely my fault.

Precedence (line 479) — rewritten in 712f690:

Listing a name here is an explicit request, so it takes precedence over the general switch: certificates are still managed for it when auto_https is set to off or disable_certs. In that it behaves like the tls directive's force_automate, which forces automation for a site even when other managed certificates apply.

I checked both halves rather than just the one I had a test for — adapting { auto_https off; tls_automate_names mail.example.com } and the same with disable_certs each leave certificates.automate: ["mail.example.com"] intact. caddyserver/caddy#8015 pins the off case in tls_automate_names_auto_https_off.caddyfiletest.

Version claim (line 485) — you asked for it removed until the target was confirmed. It has been since, in caddyserver/caddy#8015, so it now reads "2.11.5 or newer" rather than the 2.12 guess. Say the word if you would still rather it came out entirely until the release actually ships.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants